Pass the Microsoft Certified: Windows Server Hybrid Administrator Associate AZ-800 Questions and answers with Dumpstech

To create a GPO named GPO1 that only applies to a group named MemberServers, you can follow these steps:

On a domain controller or a computer that has the Remote Server Administration Tools (RSAT) installed, open Group Policy Management from the Administrative Tools menu or by typing gpmc.msc in the Run box.

In the left pane, expand your domain and right-click on Group Policy Objects. Select New to create a new GPO.

In the New GPO dialog box, enter GPO1 as the Name of the new GPO and click OK. You can also optionally select a source GPO to copy the settings from.

Right-click on the new GPO and select Edit to open the Group Policy Management Editor. Here, you can configure the settings that you want to apply to the group under the Computer Configuration and User Configuration nodes. For more information on how to edit a GPO, see Edit a Group Policy Object.

Close the Group Policy Management Editor and return to the Group Policy Management console. Right-click on the new GPO and select Scope. Here, you can specify the scope of management for the GPO, such as the links, security filtering, and WMI filtering.

Under the Security Filtering section, click on Authenticated Users and then click on Remove. This will remove the default permission granted to all authenticated users and computers to apply the GPO.

Click on Add and then type the name of the group that you want to apply the GPO to, such as MemberServers. Click OK to add the group to the security filter. You can also click on Advanced to browse the list of groups available in the domain.

Optionally, you can also configure the WMI Filtering section to further filter the GPO based on the Windows Management Instrumentation (WMI) queries. For more information on how to use WMI filtering, see Filter the scope of a GPO by using WMI filters.

To link the GPO to an organizational unit (OU) or a domain, right-click on the OU or the domain in the left pane and select Link an Existing GPO. Select the GPO that you created, such as GPO1, and click OK. You can also change the order of preference by using the Move Up and Move Down buttons.

Wait for the changes to replicate to other domain controllers. You can also force the update of the GPO by using the gpupdate /force command on the domain controller or the client computers. For more information on how to update a GPO, see Update a Group Policy Object.

Now, you have created a GPO named GPO1 that only applies to a group named MemberServers. You can verify the GPO application by using the gpresult /r command on a member server and checking the Applied Group Policy Objects entry. You can also use the Group Policy Results wizard in the Group Policy Management console to generate a report of the GPO application for a specific computer or user. For more information on how to use the Group Policy Results wizard, see Use the Group Policy Results Wizard.

To create an AD DS site named Site2 that is associated to an IP address range of 192.168.2.0 to 192.168.2.255, you can follow these steps:

On a domain controller or a computer that has the Remote Server Administration Tools (RSAT) installed, open Active Directory Sites and Services from the Administrative Tools menu or by typing dssite.msc in the Run box.

In the left pane, right-click on Sites and select New Site.

In the New Object - Site dialog box, enter Site2 as the Name of the new site. Select a site link to associate the new site with, such as DEFAULTIPSITELINK, and click OK. You can also create a new site link if you want to customize the replication frequency and schedule between the sites. For more information on how to create a site link, see Create a Site Link.

In the left pane, right-click on Subnets and select New Subnet.

In the New Object - Subnet dialog box, enter 192.168.2.0/24 as the Prefix of the subnet. This notation represents the IP address range of 192.168.2.0 to 192.168.2.255 with a subnet mask of 255.255.255.0. Select Site2 as the Site object to associate the subnet with, and click OK.

Wait for the changes to replicate to other domain controllers. You can verify the site and subnet creation by checking the Sites and Subnets containers in Active Directory Sites and Services.

Now, you have created an AD DS site named Site2 that is associated to an IP address range of 192.168.2.0 to 192.168.2.255. You can add domain controllers to the new site and configure the site links and site link bridges to optimize the replication topology.

Explore

To create a container image named app1 for your application using the Dockerfile in the C:\app directory on SRV1, follow these steps:

Step 1: Open PowerShell or Command Prompt First, open PowerShell or Command Prompt on SRV1.

Step 2: Navigate to the Application Directory Change to the directory where your application and Dockerfile are located:

cd C:\app

Step 3: Build the Container Image Use the docker build command to create the container image. The -t flag tags the image with the name app1:

docker build -t app1 .

The period . at the end of the command tells Docker to use the Dockerfile in the current directory.

Step 4: Verify the Image Creation After the build process completes, verify that the image app1 has been created successfully by listing all images:

docker images

You should see app1 in the list of images.

Step 5: Use the Image Now, you can use the image app1 to run containers or push it to a container registry if needed.

By following these steps, you’ll have created a Docker container image named app1 using the Dockerfile located in C:\app on SRV11. Ensure that Docker is installed on SRV1 and that you have the necessary permissions to execute these commands.

In Windows remoting, hopping from one server to another (Server1 → Server2 → Backup1) triggers the “second-hop” problem because the user’s TGT is not forwarded. The AZ-800 material explains that members of Protected Users cannot use NTLM, DES/RC4, or unconstrained delegation, and their credentials cannot be cached or delegated. Therefore, CredSSP or unconstrained delegation cannot be used. The guide prescribes Kerberos constrained delegation to allow a middle-tier server to act on the user’s behalf, and specifically recommends resource-based constrained delegation (RBCD) because it is configured on the resource (Backup1) by setting msDS-AllowedToActOnBehalfOfOtherIdentity to allow the front-end computer account (Server2$) to delegate to the service SPN on the resource. This model follows least privilege, avoids broad domain-wide delegation, works with Protected Users, and requires minimal administration because you touch only the destination resource. In short: configure RBCD on Backup1 to permit Server2 to obtain S4U2Proxy tickets to the share service, enabling User1’s PowerShell session on Server2 to access Backup1 while remaining compliant with Protected Users restrictions and Kerberos-only authentication.

Azure Arc–enabled servers use the Azure Connected Machine agent to onboard non-Azure machines (on-premises or other clouds) so they appear in Azure for inventory, policy, Update Management, Defender, etc. The AZ-800 study guide emphasizes: “Install the Connected Machine agent on Windows or Linux servers that are outside of Azure. Native Azure VMs are already Azure resources and can be managed without Arc; onboarding Azure VMs to Arc is optional and not required for basic management.” In the scenario, Server1 (a physical on-premises server) and VM2 (a Hyper-V VM on-premises) are non-Azure; both require the Connected Machine agent to be projected into Azure via Arc. VM1 is already an Azure VM and can be managed through Azure natively (Azure VM resource model, extensions, policies) without installing the Arc agent. Because the requirement is to manage all servers via Azure Arc while minimizing administrative effort, you install the agent only where it’s needed—on Server1 and VM2. This provides Arc governance and management for on-prem systems without redundant configuration on the Azure VM.

In Windows Server container deployments, the isolation mode determines kernel compatibility between the host and the container image. The Administering Windows Server Hybrid Core Infrastructure materials explain that Windows Server containers using process isolation share the host kernel and therefore require the container image to match the host’s OS version/build. The guide contrasts this with Hyper-V isolation, stating that each container runs inside a lightweight utility VM: “Hyper-V isolated containers do not share the host kernel; they provide a separate kernel instance, allowing containers built on a different Windows build (or earlier Windows Server version) to run on a newer host.”

Because Host1 is Windows Server 2022 and image1 is based on Windows Server 2019, process isolation would fail due to the version mismatch. The documented remediation is to start the container with Hyper-V isolation, which decouples the container from the host’s kernel requirements. The study guide shows this operationally with Docker: “Use docker run … --isolation=hyperv when the container base image version differs from the host.”

Therefore, to successfully start the container on Host1, you must use the Docker CLI with Hyper-V isolation:

Docker run -d --isolation=hyperv image1.